PT-2021-4609 · Leptonica+1 · Leptonica+1
Dan Bloomberg
·
Published
2021-03-12
·
Updated
2025-01-28
·
CVE-2020-36281
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Leptonica versions prior to 1.80.0
Description
The issue is related to a heap-based buffer over-read in the
pixFewColorsOctcubeQuantMixed function in the colorquant1.c file. This can potentially allow a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is not specified.Recommendations
For versions prior to 1.80.0, update to version 1.80.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the
pixFewColorsOctcubeQuantMixed function in the colorquant1.c file until a patch is available.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Leptonica